Comprehensive comparison for Authentication technology in Software Development applications

import duo_client
import flask
import os
import hashlib
import hmac
import time
from functools import wraps

app = flask.Flask(__name__)

# Duo configuration from environment variables
DUO_IKEY = os.environ.get('DUO_IKEY')
DUO_SKEY = os.environ.get('DUO_SKEY')
DUO_HOST = os.environ.get('DUO_HOST')
DUO_AKEY = os.environ.get('DUO_AKEY')  # Application secret key

# Initialize Duo Auth API client
auth_api = duo_client.Auth(
    ikey=DUO_IKEY,
    skey=DUO_SKEY,
    host=DUO_HOST
)

def generate_duo_sig(username, ikey, skey, akey):
    """Generate Duo signature for Web SDK integration"""
    duo_sig = hmac.new(
        skey.encode(),
        f"{username}|{ikey}|{int(time.time())}".encode(),
        hashlib.sha1
    ).hexdigest()
    
    app_sig = hmac.new(
        akey.encode(),
        f"{username}|{ikey}|{int(time.time())}".encode(),
        hashlib.sha1
    ).hexdigest()
    
    return f"{duo_sig}:{app_sig}"

def require_duo_auth(f):
    """Decorator to enforce Duo 2FA on protected endpoints"""
    @wraps(f)
    def decorated_function(*args, **kwargs):
        username = flask.request.headers.get('X-Username')
        duo_response = flask.request.headers.get('X-Duo-Response')
        
        if not username or not duo_response:
            return flask.jsonify({
                'error': 'Missing authentication credentials',
                'duo_required': True
            }), 401
        
        try:
            # Verify Duo authentication response
            authenticated_username = auth_api.verify_response(
                duo_response,
                username
            )
            
            if authenticated_username != username:
                return flask.jsonify({
                    'error': 'Duo authentication failed',
                    'message': 'Username mismatch'
                }), 403
            
            # Store authenticated user in request context
            flask.g.authenticated_user = authenticated_username
            return f(*args, **kwargs)
            
        except duo_client.DuoException as e:
            return flask.jsonify({
                'error': 'Duo authentication error',
                'message': str(e)
            }), 403
        except Exception as e:
            return flask.jsonify({
                'error': 'Internal authentication error',
                'message': 'Please try again later'
            }), 500
    
    return decorated_function

@app.route('/api/duo/enroll', methods=['POST'])
def enroll_user():
    """Enroll a new user with Duo for 2FA"""
    data = flask.request.get_json()
    username = data.get('username')
    email = data.get('email')
    phone = data.get('phone')
    
    if not username or not email:
        return flask.jsonify({'error': 'Username and email required'}), 400
    
    try:
        # Enroll user in Duo
        result = auth_api.enroll(
            username=username,
            valid_secs=3600
        )
        
        return flask.jsonify({
            'success': True,
            'activation_url': result.get('activation_url'),
            'expiration': result.get('expiration'),
            'user_id': result.get('user_id')
        }), 200
        
    except duo_client.DuoException as e:
        return flask.jsonify({
            'error': 'Enrollment failed',
            'message': str(e)
        }), 400

@app.route('/api/duo/preauth', methods=['POST'])
def preauth():
    """Check if user requires Duo 2FA"""
    data = flask.request.get_json()
    username = data.get('username')
    
    if not username:
        return flask.jsonify({'error': 'Username required'}), 400
    
    try:
        result = auth_api.preauth(username=username)
        
        return flask.jsonify({
            'result': result.get('result'),
            'status': result.get('status'),
            'status_msg': result.get('status_msg'),
            'devices': result.get('devices', [])
        }), 200
        
    except duo_client.DuoException as e:
        return flask.jsonify({
            'error': 'Preauth failed',
            'message': str(e)
        }), 400

@app.route('/api/protected/resource', methods=['GET'])
@require_duo_auth
def protected_resource():
    """Example protected endpoint requiring Duo 2FA"""
    username = flask.g.authenticated_user
    
    return flask.jsonify({
        'message': 'Access granted to protected resource',
        'user': username,
        'data': {
            'resource_id': '12345',
            'sensitive_info': 'This data is protected by Duo 2FA'
        }
    }), 200

if __name__ == '__main__':
    # Validate required environment variables
    required_vars = ['DUO_IKEY', 'DUO_SKEY', 'DUO_HOST', 'DUO_AKEY']
    missing_vars = [var for var in required_vars if not os.environ.get(var)]
    
    if missing_vars:
        raise EnvironmentError(f"Missing required environment variables: {', '.join(missing_vars)}")
    
    app.run(debug=False, host='0.0.0.0', port=5000)